ReviewToolkits/code-review-toolkit
Agent
Use this agent to perform deep temporal analysis of a codebase. It runs LAST in the explore pipeline and uses output from all other agents alongside git history to perform fix completeness review, similar bug detection, new feature review, churn×quality risk matrix, historical context annotation of other agents'…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to provide temporal context for all other agents by analyzing git history. It runs the analysis script and produces churn metrics, recent change classifications, co-change clusters, and per-module stability ratings. This is the temporal counterpart to architecture-mapper — it runs first in the explore…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to extract the defect-grade signal from a linter run and turn it into review findings — and, more valuably, into new bug shapes. Backed by runlintrules.py, which runs a pinned, explicitly-tiered ruff selection (tier 1 = "the code is wrong", tier 2 = "likely a defect") rather than a style pass. It merges…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to find places where a Python codebase solves the same problem in different ways. While the consistency-auditor focuses on style and convention divergence, this agent focuses on behavioral pattern divergence — where the same concern (configuration loading, resource cleanup, serialization, CLI argument…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to audit out-of-code documentation (README, CLAUDE.md, CONTRIBUTING.md, configuration files) for accuracy against the actual codebase. Unlike the documentation-auditor (which covers in-code docstrings and comments), this agent focuses on external-facing documentation. It has three concrete, verifiable…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to find concrete correctness defects in Python code — the pitfalls that silently produce wrong results rather than raising. Covers mutable default arguments, late-binding closures in loops, unreachable except ordering, return inside finally, eq without hash, mutation during iteration, the asyncio family…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to scan a Python codebase for silent failures, inadequate error handling, and inappropriate fallback behavior. Unlike the PR-focused version, this agent traverses all error handling in scope rather than just reviewing a diff. It systematically finds every try/except, bare except, swallowed exception…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to catalog technical debt in a Python codebase — TODOs, FIXMEs, HACKs, deprecated API usage, pinned workarounds, and deferred decisions. It collects, categorizes, and ages debt items using git blame to distinguish fresh debt from ancient debt. Produces an actionable inventory for sprint planning or…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to analyze test coverage quality and completeness across an existing Python codebase. Unlike a PR test reviewer that checks whether new changes are tested, this agent correlates source modules with test files, identifies undertested modules, and assesses behavioral coverage without running tests. It…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to find bugs by treating tests as invariant specifications. It reads existing tests to extract what developers believe should be true, maps those beliefs to the code under test AND structurally similar code, then checks whether the invariants hold on untested paths and analogous functions. Unlike…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to analyze type design quality in a Python codebase — type hint coverage, dataclass/TypedDict/NamedTuple design, Protocol usage, Any overuse, and invariant enforcement. Adapted for Python's gradual typing system where not everything needs annotations and the trade-offs between typing approaches differ…
ReviewToolkits/code-review-toolkit
Agent
Use this agent to find defects that a type checker can prove — and, more importantly, to find annotations that have silently stopped checking anything. Backed by checktyping.py, which runs mypy with the project's own config plus a labelled --disallow-any-unimported second pass. Its signature finding is the phantom…
ReviewToolkits/code-review-toolkit
Command
Release-gating audit: run every scanner, require a machine-readable sign-off line, and BLOCK on an incomplete run. Converts the toolkit from exploratory to gating.
ReviewToolkits/code-review-toolkit
Command
Comprehensive codebase exploration and analysis using specialized agents.
ReviewToolkits/code-review-toolkit
Command
Quick health dashboard — all agents in summary mode.
ReviewToolkits/code-review-toolkit
Command
Find cleanup targets — complexity hotspots, dead code, and tech debt.
ReviewToolkits/code-review-toolkit
Command
Like explore, but INFORMED: every agent first reads a briefing of recurring Python bug SHAPES (sibling-hunt templates with their guarded twins), the false-positive taxonomy, and the cross-cutting triage rules — so it confirms-without-relitigating, suppresses known FPs, and hunts un-found siblings of established shapes…
ReviewToolkits/code-review-toolkit
Command
Cross-reference a catalog of previously-found findings against a fresh scan, so a fix — or a regression after a revert — is detected. Static and drift-tolerant: no repros are run.
ReviewToolkits/code-review-toolkit
Command
Quick architecture mapping — understand project structure and dependencies.
ReviewToolkits/code-review-toolkit
Command
Search a project's tracker before calling a finding novel. The cheapest high-value step in a review: it refutes wrong findings, and it redirects 'file a new issue' to 'comment on the existing one'.
ReviewToolkits/cpython-security-toolkit
Instructions file
Claude Code instructions for ReviewToolkits/cpython-security-toolkit, covering cpython-security-toolkit — claude code instructions, what this toolkit does, critical constraint: reproducers are non-optional, critical constraint: disclosure routing and confidence classification.
ReviewToolkits/cpython-security-toolkit
Agent
Detects file-loading paths that bypass sys.audit() hooks by using open() instead of io.opencode(), and shell-calling paths where validation occurs before template substitution. Invoke when scanning importlib, webbrowser, or venv.
ReviewToolkits/cpython-security-toolkit
Agent
Detects decompression paths that materialize unbounded output before applying a size check, and allocations whose size is directly controlled by attacker-supplied archive metadata. Invoke when scanning zipfile, tarfile, lzma, bz2, gzip, or plistlib.
ReviewToolkits/cpython-security-toolkit
Agent
Analyzes CPython security fix commits and checks whether the fix was applied to all code paths through the same invariant. The most important agent for preventing second-round CVEs. Invoke after identifying a security fix commit or when reviewing recent type-security labeled changes.